HackTricks: an mdBook security notebook you can self-host, with languages kept as git branches and an amd64-only build image

A personal notebook of techniques, rendered as an mdBook

HackTricks started as one author's collection of every trick and technique learnt in CTFs, real-life applications, and from reading research and news, and it is published at book.hacktricks.xyz. The repository is an mdBook project: book.toml configures the book, src/ holds the pages, theme/ holds the styling, and hacktricks-preprocessor.py is a custom preprocessor that runs during the build. That is why GitHub reports CSS as the primary language even though the substance is written pages. The preprocessor reads an environment variable, MDBOOK_PREPROCESSOR__HACKTRICKS__ENV, which both the Compose file and the Dockerfile set to dev for local serving. For a reader the consequence is simple: there is no program to install and nothing to run against a target. You either read the hosted book or build the same pages yourself.

A local copy builds in minutes and serves on port 3337

Self-hosting starts with a clone:

git clone https://github.com/HackTricks-wiki/hacktricks

The shortest path from there is Docker Compose, run from the repository root:

docker compose up

The bundled docker-compose.yml starts a container named hacktricks from ghcr.io/hacktricks-wiki/hacktricks-cloud/translator-image:latest, mounts the checkout at /app, maps host port 3337 to container port 3000, marks /app as a safe git directory, and runs mdbook serve --hostname 0.0.0.0 --port 3000. The comment at the top notes that podman compose up works as well. The book appears at http://localhost:3337 after it finishes building, which takes under five minutes, and Compose gives you live reload, so edits to pages in your checkout show up without a restart. The cost is the first build: the book is assembled on your machine every time, and the README asks you to be patient rather than offering a prebuilt site.

Translations are separate git branches, not a runtime setting

HackTricks keeps each translation on its own branch. The local run instructions use an HT_LANG variable to pick one:

export HT_LANG="master" # Leave master for English

The listed codes are af for Afrikaans, de, el, es, fr, hi, it, ja, ko, pl, pt, sr, sw, tr, uk, vi and zh for Chinese, so English plus 17 other languages. With Compose, HT_LANG does not apply at all: the container serves whatever branch is checked out on the host, and switching languages means running git checkout on the language branch before starting the service. This design has a practical consequence for anyone mirroring several languages. One running container serves one language, so a multilingual internal mirror needs a separate checkout and container per language, each on its own port. It also means a shallow or single-branch clone will not contain the other translations.

The build image is amd64-only and tracks latest

Both the Compose file and the Dockerfile build on ghcr.io/hacktricks-wiki/hacktricks-cloud/translator-image:latest, and docker-compose.yml pins platform: linux/amd64 with the comment that the published image is amd64-only. On an ARM host, such as an ARM server, there is no native image, so the container depends on your Docker setup being able to run amd64 images. The :latest tag adds a second issue: the toolchain inside that image can change between pulls without any change in this repository, so a build that worked last month is not guaranteed to behave the same way after a fresh pull. If you run HackTricks on an internal network and need stable rebuilds, record the image digest you pulled and keep a copy, because the repository itself does not pin one.

The Dockerfile pulls from GitHub during the build

The Dockerfile is a different route from Compose and was written for a CapRover deployment, as its Spanish comments say. It takes a build argument HT_LANG that defaults to master, runs ssh-keyscan -H github.com into known_hosts, copies the cloned repository into /app, and then runs git checkout ${HT_LANG} && git pull. Finally it serves the book with mdbook serve on port 3000, which the image exposes. Two consequences follow. First, the build needs network access to GitHub, so it fails in an air-gapped environment even though you already have the files. Second, because of the git pull, the content in the image is whatever the upstream branch held at build time, merged with your copy, not a frozen version of your local checkout. Anyone who wants an exact snapshot should use the Compose route against a checkout they control.

There are no versioned releases, only search index assets

The repository's releases are not version numbers. The recent ones are named searchindex-en, searchindex-zh and searchindex-uk, published on 2025-10-01, which are search index files for the English, Chinese and Ukrainian books. There is no tagged edition you can download and cite. The working state is the master branch and the language branches, and the last push landed on 2026-11-02. For a reader this means two things. A page you bookmark can be rewritten at any time, so if you rely on a specific technique write-up for a report or a training course, save your own copy. And a local mirror is only as current as your last git pull; it will not update itself.

The README is mostly a sponsor page, and license terms live elsewhere

Apart from the local run section, the README is given over to partners and friends: STM Cyber, Intigriti, Modern Security, SerpApi, 8kSec Academy, NaxusAI, WebSec, CyberHelmets, Last Tower Solutions and K8Studio, several with referral links such as go.intigriti.com/hacktricks or a ref=hacktricks parameter. Treat those blurbs as vendor descriptions, not endorsements of fitness for your needs. GitHub does not detect a license for the repository; the README's License & Disclaimer section points to the HackTricks Values & FAQ page instead. If you plan to republish pages, translate them, or bundle a mirror into a product or course, read that page first, because the repository does not carry a standard license file that answers the question. The root also holds build leftovers such as .mdbook-build.err, .mdbook-build.log, .tmp_hope.pdf and .tmp_malloc.c, plus AGENTS.md and organization-agent.md, and a clean_unused_images.sh helper for pruning images.

Editorial conclusion

HackTricks is a strong fit for security practitioners and CTF players who want the book offline or on an internal network, and who are comfortable with Docker and git branches. It is a poor fit for anyone needing a reproducible, versioned snapshot, a native ARM build, or clear license terms from the repository alone. Before mirroring it, check the HackTricks Values & FAQ page for license terms, confirm your Docker host can run linux/amd64 images, and decide which language branch you will serve.

Frequently asked questions

Official sources

1. HackTricks-wiki/hacktricks on GitHub
2. Issues
3. Project website
4. README
5. Releases